theta42/sso-manager-node
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Permission based on owners of groups

Browse Source
This commit is contained in:
William Mantly
2020-12-31 15:00:02 -05:00
parent cb51fae2f6
commit 07f3c8b023
2 changed files with 40 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files
nodejs/routes/group.js
+20 -21
View File
@@ -42,81 +42,80 @@ router.get('/:name', async function(req, res, next){
} }
}); });
router.put('/owner/:name/:uid', async function(req, res, next){ router.put('/owner/:group/:uid', async function(req, res, next){
try{ try{
// await permission.byGroup(req.user, ['app_sso_admin']); await permission.byGroup(req.user, ['app_sso_admin'], [req.params.group]);
var group = await Group.get(req.params.name); var group = await Group.get(req.params.group);
var user = await User.get(req.params.uid); var user = await User.get(req.params.uid);
return res.json({ return res.json({
results: group.addOwner(user), results: group.addOwner(user),
message: `Added owner ${req.params.uid} to ${req.params.name} group.` message: `Added owner ${req.params.uid} to ${req.params.group} group.`
}); });
}catch(error){ }catch(error){
next(error); next(error);
} }
}); });
router.delete('/owner/:name/:uid', async function(req, res, next){ router.delete('/owner/:group/:uid', async function(req, res, next){
try{ try{
await permission.byGroup(req.user, ['app_sso_admin']); await permission.byGroup(req.user, ['app_sso_admin'], [req.params.group]);
var group = await Group.get(req.params.name); var group = await Group.get(req.params.group);
var user = await User.get(req.params.uid); var user = await User.get(req.params.uid);
return res.json({ return res.json({
results: group.removeOwner(user), results: group.removeOwner(user),
message: `Removed Owner ${req.params.uid} from ${req.params.name} group.` message: `Removed Owner ${req.params.uid} from ${req.params.group} group.`
}); });
}catch(error){ }catch(error){
next(error); next(error);
} }
}); });
router.put('/:group/:uid', async function(req, res, next){
router.put('/:name/:uid', async function(req, res, next){
try{ try{
// await permission.byGroup(req.user, ['app_sso_admin']); await permission.byGroup(req.user, ['app_sso_admin'], [req.params.group]);
var group = await Group.get(req.params.name); var group = await Group.get(req.params.group);
var user = await User.get(req.params.uid); var user = await User.get(req.params.uid);
return res.json({ return res.json({
results: group.addMember(user), results: group.addMember(user),
message: `Added user ${req.params.uid} to ${req.params.name} group.` message: `Added user ${req.params.uid} to ${req.params.group} group.`
}); });
}catch(error){ }catch(error){
next(error); next(error);
} }
}); });
router.delete('/:name/:uid', async function(req, res, next){ router.delete('/:group/:uid', async function(req, res, next){
try{ try{
await permission.byGroup(req.user, ['app_sso_admin']); await permission.byGroup(req.user, ['app_sso_admin'], [req.params.group]);
var group = await Group.get(req.params.name); var group = await Group.get(req.params.group);
var user = await User.get(req.params.uid); var user = await User.get(req.params.uid);
return res.json({ return res.json({
results: group.removeMember(user), results: group.removeMember(user),
message: `Removed user ${req.params.uid} from ${req.params.name} group.` message: `Removed user ${req.params.uid} from ${req.params.group} group.`
}); });
}catch(error){ }catch(error){
next(error); next(error);
} }
}); });
router.delete('/:name', async function(req, res, next){ router.delete('/:group', async function(req, res, next){
try{ try{
await permission.byGroup(req.user, ['app_sso_admin']); await permission.byGroup(req.user, ['app_sso_admin'], [req.params.group]);
var group = await Group.get(req.params.name); var group = await Group.get(req.params.group);
return res.json({ return res.json({
removed: await group.remove(), removed: await group.remove(),
results: group, results: group,
message: `Group ${req.params.name} Deleted` message: `Group ${req.params.group} Deleted`
}); });
}catch(error){ }catch(error){
next(error); next(error);
nodejs/utils/permission.js
+20 -8
View File
@@ -2,21 +2,33 @@
const {Group} = require('../models/group_ldap'); const {Group} = require('../models/group_ldap');
let byGroup = async function(user, groups){ let byGroup = async function(user, groups, ownerOf){
for(let group of groups){ for(let group of groups){
try{ try{
console.log('checking group', group, 'for access', groups, ownerOf)
group = await Group.get(group); group = await Group.get(group);
if(group.member.includes(user.dn)) return true if(group.member.includes(user.dn)) return true
}catch(error){ }catch(error){
throw error; console.error('Error byGroup', groups, ownerOf);
} }
let error = new Error('Insufficient Permission');
error.name = 'Insufficient Permission';
error.message = `You do not have permission to perform this action.`;
error.status = 401;
throw error;
} }
for(let group of ownerOf || []){
try{
console.log('checking group owners', group, 'for access', groups, ownerOf)
group = await Group.get(group);
if(group.owner.includes(user.dn)) return true
}catch(error){
console.error('Error byGroup', groups, ownerOf);
}
}
let error = new Error('Insufficient Permission');
error.name = 'Insufficient Permission';
error.message = `You do not have permission to perform this action.`;
error.status = 401;
throw error;
} }
module.exports = {byGroup}; module.exports = {byGroup};